gosec
securego/gosecSecurity scanner and static analyzer for Go source code
PersonalEnterpriseDeveloper toolsSecurity & identityDocker / self-hostCLILibrary / SDKPermissiveAt a glance
- stars on GitHub
- 9k
- contributors
- 194+
- last commit
- latest release, last week
- v2.30.0
- license
- Apache-2.0
About
gosec is a static analysis tool that inspects Go code for security vulnerabilities and risky coding patterns. It scans the Go AST and SSA representations using pattern-matching rules and taint analysis to detect issues such as injection risks, weak cryptography, and unsafe file handling. Developers run it locally via the CLI or embed it into CI/CD pipelines and GitHub code scanning with SARIF or JSON outputs.
From the repository: “Go security checker”
Downloads
All releases on GitHub ↗Latest release: v2.30.0, . Its files were downloaded 16,810 times.
All files (19)
Windows
- gosec_2.30.0_windows_arm64.tar.gz32 MB · 36 downloads
- gosec_2.30.0_windows_amd64.tar.gz34 MB · 147 downloads
- gosec_2.30.0_windows_amd64.tar.gz.sigstore.json3.8 KB · 9 downloads
- gosec_2.30.0_windows_arm64.tar.gz.sigstore.json3.7 KB · 7 downloads
macOS
- gosec_2.30.0_darwin_arm64.tar.gz35 MB · 524 downloads
- gosec_2.30.0_darwin_amd64.tar.gz36 MB · 86 downloads
- gosec_2.30.0_darwin_arm64.tar.gz.sigstore.json3.9 KB · 8 downloads
- gosec_2.30.0_darwin_amd64.tar.gz.sigstore.json3.7 KB · 8 downloads
Linux
- gosec_2.30.0_linux_s390x.tar.gz33 MB · 17 downloads
- gosec_2.30.0_linux_ppc64le.tar.gz32 MB · 18 downloads
- gosec_2.30.0_linux_arm64.tar.gz32 MB · 964 downloads
- gosec_2.30.0_linux_amd64.tar.gz34 MB · 9.1k downloads
- gosec_2.30.0_linux_s390x.tar.gz.sigstore.json3.8 KB · 6 downloads
- gosec_2.30.0_linux_ppc64le.tar.gz.sigstore.json3.7 KB · 6 downloads
- gosec_2.30.0_linux_arm64.tar.gz.sigstore.json3.8 KB · 7 downloads
- gosec_2.30.0_linux_amd64.tar.gz.sigstore.json3.7 KB · 16 downloads
Other files
- bom.json60 KB · 12 downloads
To check the files: gosec_2.30.0_checksums.txt, gosec_2.30.0_checksums.txt.sigstore.json
These files come from the project's GitHub release. DigGitHub does not check them.
Alternatives
All alternatives →| Project | Stars | Last commit | License | Worth |
|---|---|---|---|---|
 gosecThis project | 9k | Apache-2.0 | 78 | |
 infisicalOpen-source secrets, certificate, and privileged access platform | 30k | Custom (read before use) | 79 | |
 ShannonAI pentester for your web apps and APIs | 51k (best) | AGPL-3.0 | 89 (best) | |
 RuffExtremely fast Python linter and formatter | 50k | MIT | 85 | |
 AFLplusplusState-of-the-art coverage-guided fuzzer based on AFL | 6.8k | AGPL-3.0 | 78 |
▲ marks the most stars and the best worth score.
